OK, so on a vanilla Ubuntu 14.04.2 install, i run the following commands:

sudo bash -c 'echo 1 > "/proc/sys/net/ipv4/ip_forward"'
sudo iptables -t nat -A PREROUTING -d -j DNAT --to-destination
sudo tcpdump -i wlan0 icmp and icmp[icmptype]=icmp-echo -n

​ Then i ping from another terminal. But, i see tcpdump showing me this:

01:46:37.536354 IP > ICMP echo request, id 6635, seq 1, length 64

However, if i flush the nat table and run this command instead:

sudo iptables -t nat -A OUTPUT -d -j DNAT --to-destination

Then, tcpdump gives this:

01:46:53.168639 IP > ICMP echo request, id 6638, seq 1, length 64

(The ping is successful, with a pong coming back from the other machine.)

From the numerous tutorials online, i'd expect the destination IP to be changed even in the PREROUTING chain, right? Or am i missing something?

1 Answer 1


The PREROUTING chain is not evaluated on packets generated by local processes.

Your first rule will work on packet entering from a network interface (try to ping from a different computer).

Maybe this picture can clarify how the flow of packets is examined: Packet filtering in iptables

source: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Security_Guide/sect-Security_Guide-IPTables.html

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .